Introduction
Remote code execution on a domain controller can mean total compromise of an organization's identity infrastructure. CVE-2025-10230 is a critical command injection flaw in Samba's WINS server that, under certain configurations, lets unauthenticated attackers execute arbitrary commands as the Samba process. This post covers the technical details, affected versions, patch guidance, and detection methods for security teams.
About Samba: Samba is the most widely used open-source implementation of the SMB protocol. It lets Linux and Unix systems work with Windows networks for file sharing, authentication, and Active Directory services. It ships with all major Linux distributions and runs hybrid environments in enterprises, education, and government.
Technical Information
The flaw is in Samba's WINS server implementation. It applies only when Samba acts as an Active Directory Domain Controller with WINS support enabled and a 'wins hook' parameter configured.
- Vulnerability Mechanism: When Samba receives a WINS registration packet, it inserts the NetBIOS name from the packet directly into a shell command and executes it. Samba does not validate or escape the name, which can be up to 15 characters long and may include shell metacharacters.
- Attack Vector: An attacker sends a crafted WINS registration packet to UDP port 137 with a NetBIOS name containing shell metacharacters (such as
;,|,&, or backticks). The injected shell code runs with the privileges of the Samba process, often root. - Root Cause: Samba does not sanitize the NetBIOS name field before passing it to a shell command (CWE-78: OS Command Injection).
- Affected Configuration: Only Samba servers acting as Active Directory Domain Controllers with 'wins support = yes' and a non-empty 'wins hook' parameter in
smb.confare vulnerable. The default configuration is not affected.
Patch Information
The Samba team has released fixes for CVE-2025-10230 in versions 4.23.2, 4.22.5, and 4.21.9. The fix validates and sanitizes NetBIOS names before Samba passes them to any shell command through the 'wins hook' mechanism. Administrators should upgrade to one of these versions or apply the official patch from the Samba team, available on the Samba Security Advisory and Patches page.
Detection Methods
To detect exploitation of CVE-2025-10230, check these four areas:
- Network traffic: Monitor UDP port 137 for unusual or unauthorized WINS registration requests, especially from unfamiliar sources.
- Samba logs: Audit them for unexpected or unauthorized executions of the 'wins hook' script.
- Configuration: Check
smb.confon domain controllers for the 'wins hook' parameter. If it is set, the system is at risk. - Indicators of compromise: Look for unauthorized shell commands executed by the Samba process, and for unexpected network connections that the server initiates.
For ongoing monitoring:
- Use an IDS to detect anomalies in Samba-related network traffic and system behavior.
- Review system and Samba logs regularly.
- Disable features you do not need, such as WINS support and 'wins hook' scripts.
Reference: Samba Security Advisory
Affected Systems and Versions
- Products: Samba (when configured as an Active Directory Domain Controller with WINS support and a 'wins hook' parameter)
- Affected Versions:
- All versions from 4.0 up to and including 4.21.8
- 4.22.0 through 4.22.4
- 4.23.0 and 4.23.1
- Vulnerable Configuration:
- 'server role = domain controller' (or equivalent)
- 'wins support = yes'
- Non-empty 'wins hook' parameter in
smb.conf
Vendor Security History
Samba has fixed critical vulnerabilities before, including CVE-2021-44142 (remote code execution in the vfs_fruit module) and CVE-2024-3592 (a file server flaw).
The Samba team has a mature security advisory process and coordinates closely with major Linux distributions to deliver patches on time. That this issue persisted across so many versions shows the risk of keeping legacy protocol support.
